agenttesla | 1cc3f2ee6a83832c378f4369c71aae81616ebf016af234e6c71e59fa5e807ec2

General

Target

final SEAWAY BILL pdf.exe
Size

908KB
MD5

c1b8b4e30ea64942210e7708131fcb6b
SHA1

e9c5e2c762225ff260711276313b37b8ca5e491b
SHA256

1cc3f2ee6a83832c378f4369c71aae81616ebf016af234e6c71e59fa5e807ec2
SHA512

6bca34084961117d64be62deb809c6b6aa1273ec7986a2b659434af02b5472cfd01725c30d227b09bb02004762978e63542af3ebc5ffbf042aaeecd2e43e70e6
SSDEEP

24576:qwlG1wF9EwXcPd4D4kFFp9FyjQ1W5d+gXd/qwvagNd/xFPoFuywVdDwCbJKATsI2:qwlG1wF9EwXcPd4D4kFFp9FyjQ1W5d+X

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1644755040:AAGRTnph6BdO8-t1bJaOyVu9aeuJErmisqs/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

final SEAWAY BILL pdf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	final SEAWAY BILL pdf.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yGbzOMp = "C:\\Users\\Admin\\AppData\\Roaming\\yGbzOMp\\yGbzOMp.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

final SEAWAY BILL pdf.exe

description pid process target process

PID 2156 set thread context of 3632 2156 final SEAWAY BILL pdf.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1104 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

final SEAWAY BILL pdf.exe

pid process

2156 final SEAWAY BILL pdf.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

final SEAWAY BILL pdf.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 2156 final SEAWAY BILL pdf.exe
Token: SeDebugPrivilege 3632 RegSvcs.exe

description	pid	process	target process
PID 2156 set thread context of 3632	2156	final SEAWAY BILL pdf.exe	RegSvcs.exe

pid	process
1104	schtasks.exe

pid	process
2156	final SEAWAY BILL pdf.exe

description	pid	process
Token: SeDebugPrivilege	2156	final SEAWAY BILL pdf.exe
Token: SeDebugPrivilege	3632	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

final SEAWAY BILL pdf.exe

description	pid	process	target process
PID 2156 wrote to memory of 1104	2156	final SEAWAY BILL pdf.exe	schtasks.exe
PID 2156 wrote to memory of 1104	2156	final SEAWAY BILL pdf.exe	schtasks.exe
PID 2156 wrote to memory of 1104	2156	final SEAWAY BILL pdf.exe	schtasks.exe
PID 2156 wrote to memory of 3632	2156	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 2156 wrote to memory of 3632	2156	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 2156 wrote to memory of 3632	2156	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 2156 wrote to memory of 3632	2156	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 2156 wrote to memory of 3632	2156	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 2156 wrote to memory of 3632	2156	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 2156 wrote to memory of 3632	2156	final SEAWAY BILL pdf.exe	RegSvcs.exe
PID 2156 wrote to memory of 3632	2156	final SEAWAY BILL pdf.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\final SEAWAY BILL pdf.exe
"C:\Users\Admin\AppData\Local\Temp\final SEAWAY BILL pdf.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uSxvrqC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2BF.tmp"
2⤵
- Creates scheduled task(s)
PID:1104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2BF.tmp
Filesize
1KB

MD5
72d87655068e5f703a58d025edbb6feb

SHA1
70b86b8fbf8352ae50c2f401abfc085e06fe0bbf

SHA256
55cb2fa962f9ecf4a76be9a03207916b00b31930d14c031d090f7854128c501b

SHA512
4380b024332d5fb0b7a506d46d377e8da6270308e0f141839189d16b9d08ac1582b57c9e4360916876ff74a38785cdb6b7dfe905a5fe23eada52d05192bb1c10

Download Submit
memory/2156-139-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/2156-134-0x00000000049E0000-0x0000000004A7C000-memory.dmp

Filesize
624KB

Download
memory/2156-136-0x0000000004B20000-0x0000000004BB2000-memory.dmp

Filesize
584KB

Download
memory/2156-137-0x0000000004AD0000-0x0000000004ADA000-memory.dmp

Filesize
40KB

Download
memory/2156-138-0x0000000004C40000-0x0000000004C96000-memory.dmp

Filesize
344KB

Download
memory/2156-133-0x0000000000100000-0x00000000001EA000-memory.dmp

Filesize
936KB

Download
memory/2156-140-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/2156-135-0x0000000005190000-0x0000000005734000-memory.dmp

Filesize
5.6MB

Download
memory/3632-144-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3632-146-0x0000000005810000-0x0000000005876000-memory.dmp

Filesize
408KB

Download
memory/3632-147-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

Filesize
64KB

Download
memory/3632-149-0x0000000006D20000-0x0000000006D70000-memory.dmp

Filesize
320KB

Download
memory/3632-150-0x0000000006F40000-0x0000000007102000-memory.dmp

Filesize
1.8MB

Download
memory/3632-151-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads